Denial of Service Vulnerability in WildFly Core by Red Hat
CVE-2026-24329

4.9MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Fuse 7
Red Hat Jboss Enterprise Application Platform 7
Red Hat Jboss Enterprise Application Platform 8
Red Hat Jboss Enterprise Application Platform Expansion Pack
Vendor
CVE Published:
11 August 2026

What is CVE-2026-24329?

A flaw in WildFly Core allows authenticated remote users with administrative privileges to inject a malformed payload into the Inet Address field through the Management Model. This action leads to server crashes and render the system unrecoverable, as the corrupted payload is written into the standalone.xml configuration file. Recovery requires manual intervention, causing denial of service for affected systems.

References

https://access.redhat.com/security/cve/CVE-2026-24329
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2431938
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Red Hat would like to thank Claudia Bartolini (TIM Security Red Team Research - TIM S.p.A), Marco Ventura (TIM Security Red Team Research - TIM S.p.A), and Massimiliano Brolli (TIM Security Red Team Research - TIM S.p.A) for reporting this issue.
.